CVE-2010-2568 (LNK vunerability) Zero Day Stuxnet-A Sample + PoC by Ivanlef0u + Links

CVE-2010-2568  -- Reserved --

Microsoft Security Advisory (2286198) Microsoft is investigating reports of limited, targeted attacks exploiting a vulnerability in Windows Shell, a component of Microsoft Windows. This advisory contains information about which versions of Windows are vulnerable as well as workarounds and mitigations for this issue.

The vulnerability exists because Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the user clicks the displayed icon of a specially crafted shortcut. This vulnerability is most likely to be exploited through removable drives. For systems that have AutoPlay disabled, customers would need to manually browse to the root folder of the removable disk in order for the vulnerability to be exploited. For Windows 7 systems, AutoPlay functionality for removable disks is automatically disabled.

Download 74ddc49a7c121a61b8d06c03f92d0c13 Stuxnet-A ac as a password protected archive (please contact me for the password if you need it)

Collection of links (in no particular order)

1. Ivanlef0u's Blog CVE-2010-2568 shorcut Lnk + PoC (Google translated to English)
2. Exploitdb Microsoft Windows Automatic LNK Shortcut File Code Execution (PoC by Ivanf0u)
3. Microsoft Security Advisory (2286198) Vulnerability in Windows Shell Could Allow Remote Code Execution
4. Brian Krebs Experts Warn of New Windows Shortcut Flaw
5. InReverse  About TmpHider/Stuxnet #1 by swirl
6. Wilders Security Forums - Rootkit.TmpHider
7. Microsoft Malware Protection Center - The Stuxnet Sting
8. Microsoft Malware Protection Center - WinNT/Stuxnet.A
9. Threatexpert - Win32/Stuxnet.A
10. ESET (Windows) Shellshocked, Or Why Win32/Stuxnet Sux… by David Harley (with special thanks to Juraj Malcho, Aleksander Matrosov and their colleagues)
11. Aleksander Matrosov http://twitpic.com/24z86b "Rootkit.TmpHider is signed with signature of Realtek Corp" http://bit.ly/a1BHaZ" /via @_MDL_ 
12. Sophos Windows shortcut vulnerability with rootkit - detailed video demo 
13. Mitigating .LNK Exploitation With Ariad — Didier Stevens 
14. Internet Storm Center Vulnerability in Windows "LNK" files?  by Joel Esler and Bojan
15. Windows zero-day attack works on all Windows systems by Chester Wisniewski
16. Stuxnet is a directed attack -- 'hack of the century' by Ralph Langner (new)

 http://www.threatexpert.com/report.aspx?md5=74ddc49a7c121a61b8d06c03f92d0c13

Submission details: Submission received: 13 July 2010, 18:26:36 Processing time: 6 min 45 sec Submitted sample: File MD5: 0x74DDC49A7C121A61B8D06C03F92D0C13 File SHA-1: 0x0CCBC128DD8BF73DC7B3922FB67D26BBCDBCAA89 Filesize: 517,632 bytes Alias: Trojan.Gen [PCTools] Trojan.Gen [Symantec] TrojanDropper:Win32/Stuxnet.A [Microsoft] Summary of the findings: What's been found Severity Level Contains characteristics of an identified security risk. Technical Details: Possible Security Risk Attention! The following threat category was identified: Threat Category Description A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment File System Modifications The following files were created in the system: # Filename(s) File Size File Hash Alias 1 %Windir%\inf\mdmcpq3.PNF 6,623 bytes MD5: 0x0DD2AF5AFE93118073CB656D813435A4 SHA-1: 0x256AC5228427FCD03FB9EC1871B15FD76E4D0879 (not available) 2 %Windir%\inf\mdmeric3.PNF 90 bytes MD5: 0xB834EBEB777EA07FB6AAB6BF35CDF07F SHA-1: 0xF7B86531AD78EB283E59091A1C64B0C47D50E6C6 (not available) 3 %Windir%\inf\oem6C.PNF 323,848 bytes MD5: 0xFA4381DF1F7F89077439A596630D5647 SHA-1: 0x152B6830777E7F2B214708A21BA28F9D625E5E16 (not available) 4 %Windir%\inf\oem7A.PNF 498,176 bytes MD5: 0xAD19FBAA55E8AD585A97BBCDDCDE59D4 SHA-1: 0xBCFCC25C6D0F58D784D5B5A4C631E920F655F50E (not available) 5 %System%\drivers\mrxcls.sys 26,616 bytes MD5: 0xF8153747BAE8B4AE48837EE17172151E SHA-1: 0xCB0793029C60C0BD059FF85DE956619F7FDEB4FD Trojan:WinNT/Stuxnet.A [Microsoft] 6 %System%\drivers\mrxnet.sys 17,400 bytes MD5: 0xCC1DB5360109DE3B857654297D262CA1 SHA-1: 0x758240613C362BB1FD13E07D3D19F357B7F8A6DA Trojan:WinNT/Stuxnet.B [Microsoft] 7 [file and pathname of the sample #1] 517,632 bytes MD5: 0x74DDC49A7C121A61B8D06C03F92D0C13 SHA-1: 0x0CCBC128DD8BF73DC7B3922FB67D26BBCDBCAA89 Trojan.Gen [PCTools] Trojan.Gen [Symantec] TrojanDropper:Win32/Stuxnet.A [Microsoft] Notes: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt. %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP). Memory Modifications There were new memory pages created in the address space of the system process(es): Process Name Process Filename Allocated Size svchost.exe %System%\svchost.exe 499,712 bytes svchost.exe %System%\svchost.exe 499,712 bytes lsass.exe %System%\lsass.exe 499,712 bytes lsass.exe %System%\lsass.exe 499,712 bytes The following modules were loaded into the address space of other process(es): Module Name Module Filename Address Space Details KERNEL32.DLL.ASLR.000246c0 %System%\KERNEL32.DLL.ASLR.000246c0 Process name: services.exe Process filename: %System%\services.exe Address space: 0xE50000 - 0xF88000 KERNEL32.DLL.ASLR.000245d2 %System%\KERNEL32.DLL.ASLR.000245d2 Process name: svchost.exe Process filename: %System%\svchost.exe Address space: 0x9D0000 - 0xB08000 KERNEL32.DLL.ASLR.0002454e %System%\KERNEL32.DLL.ASLR.0002454e Process name: svchost.exe Process filename: %System%\svchost.exe Address space: 0x2490000 - 0x25C8000 Registry Modifications The following Registry Keys were created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS\0000 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS\0000\Control HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET\0000 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET\0000\Control HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxCls HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxCls\Enum HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxNet HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxNet\Enum HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS\0000 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS\0000\Control HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET\0000 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET\0000\Control HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCls HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCls\Enum HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxNet HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxNet\Enum The newly created Registry Values are: [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS\0000\Control] *NewlyCreated* = 0x00000000 ActiveService = "MRxCls" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS\0000] Service = "MRxCls" Legacy = 0x00000001 ConfigFlags = 0x00000000 Class = "LegacyDriver" ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}" DeviceDesc = "MRXCLS" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS] NextInstance = 0x00000001 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET\0000\Control] *NewlyCreated* = 0x00000000 ActiveService = "MRxNet" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET\0000] Service = "MRxNet" Legacy = 0x00000001 ConfigFlags = 0x00000000 Class = "LegacyDriver" ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}" DeviceDesc = "MRXNET" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET] NextInstance = 0x00000001 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxCls\Enum] 0 = "Root\LEGACY_MRXCLS\0000" Count = 0x00000001 NextInstance = 0x00000001 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxCls] Description = "MRXCLS" DisplayName = "MRXCLS" ErrorControl = 0x00000000 Group = "Network" ImagePath = "%System%\Drivers\mrxcls.sys" Start = 0x00000001 Type = 0x00000001 Data = 8F 1F F7 6D 7D B1 C9 09 9D CC 24 7A C6 9F FB 23 90 BD 9D BF F1 D4 51 92 2A B4 1F 6A 2E A6 4F B3 CB 69 7C 0B 92 3B 1B C0 D7 75 17 A9 E3 33 48 DC AD F6 DA EA 2F 87 10 C4 21 81 A5 75 68 00 2E B1 C2 7B EB DD BB 72 47 DC 87 91 14 A5 F3 C4 32 B0 CC 93 38 3 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxNet\Enum] 0 = "Root\LEGACY_MRXNET\0000" Count = 0x00000001 NextInstance = 0x00000001 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxNet] Description = "MRXNET" DisplayName = "MRXNET" ErrorControl = 0x00000000 Group = "Network" ImagePath = "%System%\Drivers\mrxnet.sys" Start = 0x00000001 Type = 0x00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS\0000\Control] *NewlyCreated* = 0x00000000 ActiveService = "MRxCls" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS\0000] Service = "MRxCls" Legacy = 0x00000001 ConfigFlags = 0x00000000 Class = "LegacyDriver" ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}" DeviceDesc = "MRXCLS" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS] NextInstance = 0x00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET\0000\Control] *NewlyCreated* = 0x00000000 ActiveService = "MRxNet" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET\0000] Service = "MRxNet" Legacy = 0x00000001 ConfigFlags = 0x00000000 Class = "LegacyDriver" ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}" DeviceDesc = "MRXNET" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET] NextInstance = 0x00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCls\Enum] 0 = "Root\LEGACY_MRXCLS\0000" Count = 0x00000001 NextInstance = 0x00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCls] Description = "MRXCLS" DisplayName = "MRXCLS" ErrorControl = 0x00000000 Group = "Network" ImagePath = "%System%\Drivers\mrxcls.sys" Start = 0x00000001 Type = 0x00000001 Data = 8F 1F F7 6D 7D B1 C9 09 9D CC 24 7A C6 9F FB 23 90 BD 9D BF F1 D4 51 92 2A B4 1F 6A 2E A6 4F B3 CB 69 7C 0B 92 3B 1B C0 D7 75 17 A9 E3 33 48 DC AD F6 DA EA 2F 87 10 C4 21 81 A5 75 68 00 2E B1 C2 7B EB DD BB 72 47 DC 87 91 14 A5 F3 C4 32 B0 CC 93 38 3 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxNet\Enum] 0 = "Root\LEGACY_MRXNET\0000" Count = 0x00000001 NextInstance = 0x00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxNet] Description = "MRXNET" DisplayName = "MRXNET" ErrorControl = 0x00000000 Group = "Network" ImagePath = "%System%\Drivers\mrxnet.sys" Start = 0x00000001 Type = 0x00000001
 From Threatexpert
  * The following files were created in the system:
#    Filename(s)    File Size    File Hash    Alias
1     %Windir%\inf\mdmcpq3.PNF     6,623 bytes     
MD5: 0x0DD2AF5AFE93118073CB656D813435A4
SHA-1: 0x256AC5228427FCD03FB9EC1871B15FD76E4D0879     (not available)

2     %Windir%\inf\mdmeric3.PNF     90 bytes    
MD5: 0xB834EBEB777EA07FB6AAB6BF35CDF07F
SHA-1: 0xF7B86531AD78EB283E59091A1C64B0C47D50E6C6     (not available)

3     %Windir%\inf\oem6C.PNF     323,848 bytes    
MD5: 0xFA4381DF1F7F89077439A596630D5647
SHA-1: 0x152B6830777E7F2B214708A21BA28F9D625E5E16     (not available)

4     %Windir%\inf\oem7A.PNF     498,176 bytes     
MD5: 0xAD19FBAA55E8AD585A97BBCDDCDE59D4
SHA-1: 0xBCFCC25C6D0F58D784D5B5A4C631E920F655F50E     (not available)

5     %System%\drivers\mrxcls.sys     26,616 bytes    
MD5: 0xF8153747BAE8B4AE48837EE17172151E
SHA-1: 0xCB0793029C60C0BD059FF85DE956619F7FDEB4FD     Trojan:WinNT/Stuxnet.A [Microsoft]

6     %System%\drivers\mrxnet.sys     17,400 bytes     
MD5: 0xCC1DB5360109DE3B857654297D262CA1
SHA-1: 0x758240613C362BB1FD13E07D3D19F357B7F8A6DA     Trojan:WinNT/Stuxnet.B [Microsoft]

7     [file and pathname of the sample #1]     517,632 bytes    
MD5: 0x74DDC49A7C121A61B8D06C03F92D0C13
SHA-1: 0x0CCBC128DD8BF73DC7B3922FB67D26BBCDBCAA89     Trojan.Gen [PCTools]
Trojan.Gen [Symantec]
TrojanDropper:Win32/Stuxnet.A [Microsoft]

Virustotal
016169ebebf1cec2aad6c7f0d0ee9026  received on 2010.07.16 11:55:58 (UTC)
http://www.virustotal.com/analisis/743e16b3ef4d39fc11c5e8ec890dcd29f034a6eca51be4f7fca6e23e60dbd7a1-1279281358
Result: 25/41 (60.98%)
a-squared     5.0.0.31     2010.07.16     Trojan-Dropper.Win32.Stuxnet!IK
AhnLab-V3     2010.07.16.00     2010.07.15     Dropper/Win32.Stuxnet
AntiVir     8.2.4.12     2010.07.16     TR/Drop.Stuxnet.D
Avast     4.8.1351.0     2010.07.16     Win32:Trojan-gen
Avast5     5.0.332.0     2010.07.16     Win32:Trojan-gen
AVG     9.0.0.836     2010.07.16     SHeur3.XLI
BitDefender     7.2     2010.07.16     Win32.Worm.Stuxnet.A
Comodo     5446     2010.07.16     TrojWare.Win32.Rootkit.Stuxnet.a
DrWeb     5.0.2.03300     2010.07.16     Trojan.Stuxnet.1
F-Secure     9.0.15370.0     2010.07.16     Trojan.Agent.AQCK
GData     21     2010.07.16     Win32.Worm.Stuxnet.A
Ikarus     T3.1.1.84.0     2010.07.16     Trojan-Dropper.Win32.Stuxnet
Kaspersky     7.0.0.125     2010.07.16     Trojan-Dropper.Win32.Stuxnet.d
McAfee     5.400.0.1158     2010.07.16     Stuxnet
McAfee-GW-Edition     2010.1     2010.07.16     Heuristic.LooksLike.Win32.NewMalware.B
Microsoft     1.6004     2010.07.16     TrojanDropper:Win32/Stuxnet.A
NOD32     5283     2010.07.16     Win32/Stuxnet.A
nProtect     2010-07-16.01     2010.07.16     Trojan.Agent.AQCK
PCTools     7.0.3.5     2010.07.16     Rootkit.Stuxnet
Prevx     3.0     2010.07.16     Medium Risk Malware
Sophos     4.55.0     2010.07.16     Troj/Stuxnet-A
Sunbelt     6591     2010.07.16     Trojan.Win32.Generic!BT
Symantec     20101.1.1.7     2010.07.16     Trojan.Gen
VBA32     3.12.12.6     2010.07.16     Trojan-Spy.0485
VirusBuster     5.0.27.0     2010.07.16     Trojan.DR.Stuxnet.C
Additional information
File size: 517632 bytes
MD5   : 74ddc49a7c121a61b8d06c03f92d0c13



 Microsoft Malware Protection Center

Trojan:WinNT/Stuxnet.A
Aliases
      Win32/PcClient.ACH (CA)


Alert Level (?) Severe
Released: Jul 07, 2010
Summary
Trojan:WinNT/Stuxnet.A is a trojan component installed by TrojanDropper:Win32/Stuxnet.A that injects code into the running process LSASS.EXE.

Symptoms
System changes
The following system changes may indicate the presence of this malware:

    *
      The presence of the following files:
      \mrxcls.sys
    *
      The presence of the following registry keys:
      HKLM\SYSTEM\CurrentControlSet\Services\MRxCls

Technical Information (Analysis)
Trojan:WinNT/Stuxnet.A is a trojan component installed by TrojanDropper:Win32/Stuxnet.A that injects code into the running process LSASS.EXE.
Installation
Trojan:WinNT/Stuxnet.A may be present as the following file:

\Drivers\mrxcls.sys

Note: refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.

The trojan component runs as a hidden service named "MRXCLS" via a registry modification as in the following example:

Sets value: "Description"
With data: "MRXCLS"
Sets value: "DisplayName"
With data: "MRXCLS"
Sets value: "ErrorControl"
With data: "0"
Sets value: "Group"
With data: "Network"
Sets value: "ImagePath"
With data: "\??\%windir%\system32\Drivers\mrxcls.sys"
Sets value: "Start"
With data: "1"
Sets value: "Type"
With data: "1"
Sets value: "Data"
With data: ""
In subkey: HKLM\SYSTEM\CurrentControlSet\Services\MRxCls
Payload
Injects code
Trojan:WinNT/Stuxnet.A is capable of injecting malicious code into the running process "LSASS.EXE" based on data written in the registry or from other TrojanDropper:Win32/Stuxnet.A components such as the following:

%windir%\inf\mdmcpq3.pnf
%windir%\inf\mdmeric3.pnf
%windir%\inf\oem6c.pnf
%windir%\inf\oem7a.pnf

Analysis by Francis Allan Tan Seng